ClawHub
Back to skill

Security audit

web-development

Security checks across malware telemetry and agentic risk

Overview

This web-development guidance skill is mostly coherent, but its authentication examples could lead an agent to create weak session handling that accepts tokens without real verification.

Review the authentication snippets before installing or using this skill. The skill is documentation-only, but agents following it may generate code that stores access tokens in browser-readable cookies and accepts tokens without validation; require real server-side token verification and secure cookie/session handling before deploying generated auth code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The section heading and inline comments describe this guard as performing token verification, but the implementation never verifies the token with the Node SDK, a cloud function, or an HTTP API. Instead, any request with an Authorization header is accepted, which directly contradicts the documented intent and could mislead developers into deploying an unverified auth path.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The comment presents this as part of a secure verification flow, but the code only writes the token into document.cookie, making it accessible to client-side scripts and not intrinsically verified. This is an intent-level mismatch because the documentation frames the step as supporting API verification while the implementation only performs insecure storage.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This markdown file includes sample code that writes a session access token into `document.cookie`, which affects user authentication data and browser state. The surrounding guidance does not warn users about the security and privacy implications of storing tokens in cookies or the need for secure cookie attributes.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The example sets `process.env.NEXT_PUBLIC_CLOUDBASE_REGION || "ap-shanghai"`, which imposes a specific regional default in natural-language guidance and code sample. There is no indication that this region is optional, user-selected, or justified as a region-specific tool, so it may violate locale policy expectations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.